X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=modules%2Fprivate%2Fcertificates.nix;h=5b86b6d1da4e9fa637afcbde31821dfbb30d095f;hb=8a05c7fb2e7aad81ce4eb31b5173f4dabf353e31;hp=82ff52f04ba0f437966e6fdbff7472cb2bf6e645;hpb=258dd18bac4bf5dd03cf1098ffa35cb954f9e015;p=perso%2FImmae%2FConfig%2FNix.git

diff --git a/modules/private/certificates.nix b/modules/private/certificates.nix
index 82ff52f..5b86b6d 100644
--- a/modules/private/certificates.nix
+++ b/modules/private/certificates.nix
@@ -4,7 +4,7 @@
     enable = lib.mkEnableOption "enable certificates";
     certConfig = lib.mkOption {
       default = {
-        webroot = "/var/lib/acme/acme-challenge";
+        webroot = "/var/lib/acme/acme-challenges";
         email = "ismael@bouya.org";
         postRun = builtins.concatStringsSep "\n" [
           (lib.optionalString config.services.httpd.Prod.enable "systemctl reload httpdProd.service")
@@ -19,11 +19,17 @@
 
   config = lib.mkIf config.myServices.certificates.enable {
     services.duplyBackup.profiles.system.excludeFile = ''
-      + /var/lib/acme/acme-challenge
+      + /var/lib/acme/acme-challenges
       '';
     services.nginx = {
       recommendedTlsSettings = true;
-      virtualHosts = { "${config.hostEnv.fqdn}" = { useACMEHost = name; forceSSL = true; }; };
+      virtualHosts = {
+        "${config.hostEnv.fqdn}" = {
+          acmeRoot = config.security.acme.certs."${name}".webroot;
+          useACMEHost = name;
+          forceSSL = true;
+        };
+      };
     };
     services.websites.certs = config.myServices.certificates.certConfig;
     myServices.databasesCerts = config.myServices.certificates.certConfig;
@@ -62,7 +68,40 @@
               #chown -R '${data.user}:${data.group}' '${data.webroot}/.well-known/acme-challenge'
             '';
           in
-            "+${script}";
+          "+${script}";
+        # This is a workaround to
+        # https://github.com/NixOS/nixpkgs/issues/84409
+        # https://github.com/NixOS/nixpkgs/issues/84633
+        serviceConfig.RemainAfterExit = lib.mkForce false;
+        serviceConfig.WorkingDirectory = lib.mkForce "/var/lib/acme/${k}/.lego";
+        serviceConfig.StateDirectory = lib.mkForce "acme/${k}/.lego acme/${k}";
+        serviceConfig.ExecStartPost =
+          let
+            keyName = builtins.replaceStrings ["*"] ["_"] data.domain;
+            fileMode = if data.allowKeysForGroup then "640" else "600";
+            spath = "/var/lib/acme/${k}/.lego";
+            script = pkgs.writeScript "acme-post-start" ''
+              #!${pkgs.runtimeShell} -e
+              cd /var/lib/acme/${k}
+
+              # Test that existing cert is older than new cert
+              KEY=${spath}/certificates/${keyName}.key
+              if [ -e $KEY -a $KEY -nt key.pem ]; then
+                cp -p ${spath}/certificates/${keyName}.key key.pem
+                cp -p ${spath}/certificates/${keyName}.crt fullchain.pem
+                cp -p ${spath}/certificates/${keyName}.issuer.crt chain.pem
+                ln -sf fullchain.pem cert.pem
+                cat key.pem fullchain.pem > full.pem
+
+                ${data.postRun}
+              fi
+
+              chmod ${fileMode} *.pem
+              chown '${data.user}:${data.group}' *.pem
+            '';
+          in
+            lib.mkForce "+${script}";
+
       }
     ) config.security.acme.certs //
     {